Date: Tue, 2 Jul 2002 16:12:50 +0200 From: Buki <dev@null.cz> To: Peter Brezny <peter@skyrunner.net> Cc: freebsd-security@FreeBSD.ORG Subject: Re: CERT Advisory CA-2002-18 OpenSSH Vulnerabilities in Challenge Response Message-ID: <20020702161250.A57959@veverka.sh.cvut.cz> In-Reply-To: <NEBBIGLHNDFEJMMIEGOOGEHGFCAA.peter@skyrunner.net>; from peter@skyrunner.net on Tue, Jul 02, 2002 at 08:47:37AM -0400 References: <NEBBIGLHNDFEJMMIEGOOGEHGFCAA.peter@skyrunner.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jul 02, 2002 at 08:47:37AM -0400, Peter Brezny wrote: > I've been trying to get clear on whether or not freebsd-stable (4.6-STABLE > FreeBSD 4.6-STABLE #0: Sat Jun 29 00:37:13 EDT 2002) has resolved the > problem listed in CA-2002-18 from CERT. > > it doesn't appear so since it's running Openssh_2.9 and > http://openssh.org/txt/preauth.adv clearly says that freebsd is vulnerable. > > > I _THOUGHT_ i found something on the freebsd site stating that OpenSSH_2.9 > FreeBSD localisations 20020307 was not vulnerable, however, I can't find it > now. > > Since there doesn't appear to be a security advisory or notice from the > freebsd security team on this one yet, what's the best thing to do? the Best Thing(tm) is to stay calm :) > > Manually update to openssh 3.4? Is an update to the base system in the > works? > you may either manually upgrade to OpenSSH 3.4 (/usr/ports/security/openssh-portable) or stick with base OpenSSH 2.9 localisation 20020307 as it is secure as many people on this list said before. But YMMV. > TIA > > > Peter Brezny > Skyrunner.net > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message Buki -- PGP public key: http://dev.null.cz/buki.asc /"\ \ / ASCII Ribbon Campaign X Against HTML & Outlook Mail / \ http://www.thebackrow.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020702161250.A57959>